ESXi 5

Tenable plugin 78108 flags ESXi 5.5 hosts running a build below 1980513 (patch bundle ESXi550-201409101-SG, September 2014) as carrying two glibc flaws: CVE-2013-0242 (buffer overflow in glibc's regex extend_buffers) and CVE-2013-1914 (stack overflow in getaddrinfo when handling huge domain conversions). Both are remote denial-of-service bugs — no code execution, no privilege gain, just a crash of whatever userland process on the ESXi busybox environment happens to call the affected glibc paths.

Vendor severity of MEDIUM (CVSSv2 5.0, AV:N/AC:L/Au:N/C:N/I:N/A:P) is generous for 2026. The vuln is a DoS in a library path that on ESXi is barely reachable from the network — the hypervisor doesn't expose a general-purpose resolver or regex service to untrusted callers. More importantly, ESXi 5.5 reached General Support end-of-life on 19 September 2018 and Technical Guidance end on 19 September 2020. Any 5.5 host in your estate in 2026 is a compliance failure long before this specific plugin fires.

Why this verdict

• Impact is availability-only: C:N/I:N/A:P. No code execution, no VM escape, no credential exposure. The worst outcome is a management-agent crash while VMs keep running.
• Attack surface on ESXi is closed: the vulnerable glibc paths (regexec, getaddrinfo) are not fed by unauthenticated network input in the default ESXi 5.5 service stack. There is no public weaponization pathway.
• Role multiplier — the hypervisor: ESXi is canonically a high-value role, so any RCE here would floor at CRITICAL. But this bug does not chain to RCE or VM escape; the role multiplier does not fire because the impact is bounded to a process crash.
• Zero threat activity: not KEV, EPSS <1%, no campaigns, no ransomware TTPs reference it.
• Product EoL dwarfs the CVE: any ESXi 5.5 host in production in 2026 is exposed to dozens of far worse unpatched CVEs (VMSA-2020-0026, VMSA-2021-0002 OpenSLP RCE / KEV, VMSA-2023-0001 vCenter chain). Fix the platform, not this bug.

Why not higher?

Vendor MEDIUM assumes the network-reachable + availability-impact classification alone justifies mid-tier. In 2026, on this component, that math no longer holds: there is no realistic unauthenticated reach into the vulnerable glibc paths on ESXi's userland, no public exploit targeting the hypervisor surface, and the impact ceiling is a process crash. Nothing about this specific CVE pair warrants LOW or MEDIUM prioritization.

Why not lower?

It is not literally impossible — a determined attacker with management-network access could conceivably force a hostd restart via a crafted management-plane request. That is why the reassessed score is 2.5, not 0.0. But operationally, if you can reach an ESXi 5.5 management plane, you are already in a game-over posture that this plugin does not describe.

1. Retire ESXi 5.5 hosts entirely — The platform has been out of Technical Guidance since 2020-09-19. Migrate VMs to a supported ESXi 7.x/8.x cluster. This is a backlog-hygiene item — no mitigation SLA applies — but any ESXi 5.5 host in your estate is a much larger risk than plugin 78108 alone. Target platform retirement inside your normal EoL replacement program.
2. Segment the ESXi management network — Per VMware hardening guide, vmk0 / management VMkernel interfaces should be reachable only from a jump / admin VLAN. This closes the network path prerequisite for this bug and dozens of worse ones. Verify with a nmap -sT -p 443,902,427 from a general user VLAN — no response is the expected result.
3. Apply patch bundle ESXi550-201409101-SG if you truly cannot decommission — If ESXi 5.5 must remain online for a documented exception window, apply the 2014 patch bundle via esxcli software vib install on the last-available offline depot. This is compliance theatre relative to the platform's larger exposure but closes the specific plugin finding.
4. Disable OpenSLP if still enabled — Not directly related to this CVE pair but is the top ransomware vector on legacy ESXi. /etc/init.d/slpd stop && chkconfig slpd off. If you own ESXi 5.5 hosts in 2026, do this today.

Run on the target ESXi host itself over SSH as root (enable SSH temporarily via DCUI or vCenter). Invoke as ./check-tenable-78108.sh. Reports VULNERABLE if the host is ESXi 5.5 below build 1980513, PATCHED if at/above, UNKNOWN if not ESXi 5.5.

#!/bin/sh
# noisgate check — Tenable 78108 / ESXi 5.5 glibc (CVE-2013-0242, CVE-2013-1914)
# Target: ESXi host shell. Requires: root.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

FIXED_BUILD=1980513

if ! command -v vmware >/dev/null 2>&1; then
  echo "UNKNOWN: not an ESXi host"
  exit 2
fi

VER_LINE=$(vmware -v 2>/dev/null)
# Expected: 'VMware ESXi 5.5.0 build-XXXXXXX'
MAJOR=$(echo "$VER_LINE" | awk '{print $3}' | cut -d. -f1,2)
BUILD=$(echo "$VER_LINE" | sed -n 's/.*build-\([0-9][0-9]*\).*/\1/p')

if [ "$MAJOR" != "5.5" ]; then
  echo "UNKNOWN: host is ESXi $MAJOR, plugin 78108 only applies to 5.5"
  exit 2
fi

if [ -z "$BUILD" ]; then
  echo "UNKNOWN: could not parse build number from: $VER_LINE"
  exit 2
fi

if [ "$BUILD" -lt "$FIXED_BUILD" ]; then
  echo "VULNERABLE: ESXi 5.5 build $BUILD < $FIXED_BUILD (CVE-2013-0242, CVE-2013-1914)"
  echo "NOTE: ESXi 5.5 is end-of-Technical-Guidance since 2020-09-19. Decommission, do not just patch."
  exit 1
fi

echo "PATCHED: ESXi 5.5 build $BUILD >= $FIXED_BUILD"
echo "NOTE: ESXi 5.5 remains end-of-life. Migrate to a supported release."
exit 0

Sources

1. Tenable plugin 78108
2. NVD — CVE-2013-0242
3. NVD — CVE-2013-1914
4. VMware KB — ESXi 5.5 patch history
5. VMware Product Lifecycle Matrix
6. Mike Tabor — VMware releases patch for glibc vulnerability on ESXi 5.5
7. CISA KEV Catalog
8. FIRST EPSS